cmd_nand: fix a memory leak in nand_dump function

If datbuf = memalign(ARCH_DMA_MINALIGN, nand->writesize);
succeeds and
  oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
fails, nand_dump function should free databuf.

Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>

diff --git a/common/cmd_nand.c b/common/cmd_nand.c
index 886212aa078a25c0da64a93ee8562b1ad3a8b9eb..a66f569a426134d42524feb395dc9bb37a4ded75 100644 (file)
--- a/common/cmd_nand.c
+++ b/common/cmd_nand.c
@@ -42,6 +42,7 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
        int i;
        u_char *datbuf, *oobbuf, *p;
        static loff_t last;
+       int ret = 0;
 
        if (repeat)
                off = last + nand->writesize;
@@ -49,11 +50,17 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
        last = off;
 
        datbuf = memalign(ARCH_DMA_MINALIGN, nand->writesize);
-       oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
-       if (!datbuf || !oobbuf) {
+       if (!datbuf) {
                puts("No memory for page buffer\n");
                return 1;
        }
+
+       oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
+       if (!oobbuf) {
+               puts("No memory for page buffer\n");
+               ret = 1;
+               goto free_dat;
+       }
        off &= ~(nand->writesize - 1);
        loff_t addr = (loff_t) off;
        struct mtd_oob_ops ops;
@@ -66,9 +73,8 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
        i = mtd_read_oob(nand, addr, &ops);
        if (i < 0) {
                printf("Error (%d) reading page %08lx\n", i, off);
-               free(datbuf);
-               free(oobbuf);
-               return 1;
+               ret = 1;
+               goto free_all;
        }
        printf("Page %08lx dump:\n", off);
        i = nand->writesize >> 4;
@@ -91,10 +97,13 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
                       p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
                p += 8;
        }
-       free(datbuf);
+
+free_all:
        free(oobbuf);
+free_dat:
+       free(datbuf);
 
-       return 0;
+       return ret;
 }
 
 /* ------------------------------------------------------------------------- */